There is a distinct lack of theoretical innovation in the cybersecurity industry. This is not to say that innovation is lacking, as new technologies, services, and solutions (as well as buzzwords) are emerging every day. This book will be the first cybersecurity text aimed at encouraging abstract and intellectual exploration of cybersecurity from the philosophical and speculative perspective. Technological innovation is certainly necessary, as it furthers the purveying of goods and services for cybersecurity producers in addition to securing the attack surface of cybersecurity consumers where able.
The issue is that the industry, sector, and even academia are largely technologically focused. There is not enough work done to further the trade-the craft of cybersecurity. This book frames the cause of this and other issues, and what can be done about them. Potential methods and directions are outlined regarding how the industry can evolve to embrace theoretical cybersecurity innovation as it pertains to the art, as much as to the science.
To do this, a taxonomy of the cybersecurity body of work is laid out to identify how the influences of the industry's past and present constrain future innovation. Then, cost-benefit analysis and right-sizing of cybersecurity roles and responsibilities-as well as defensible experimentation concepts-are presented as the foundation for moving beyond some of those constraining factors that limit theoretical cybersecurity innovation. Lastly, examples and case studies demonstrate future-oriented topics for cybersecurity theorization such as game theory, infinite-minded methodologies, and strategic cybersecurity implementations.
What you'll learn
- The current state of the cybersecurity sector and how it constrains theoretical innovation
How to understand attacker and defender cost benefit - The detect, prevent, and accept paradigm
- How to build your own cybersecurity box
- Supporting cybersecurity innovation through defensible experimentation
- How to implement strategic cybersecurity
- Infinite vs finite game play in cybersecurity
Who This Book Is For
This book is for both practitioners of cybersecurity and those who are required to, or choose to, employ such services, technology, or capabilities.
Chapter 1. Introduction.- Chapter 2. A Cyber Taxonomy.- Chapter 3. Cost Benefit.- Chapter 4. Roles and Responsibilities.- Chapter 5. Experimentation.- Chapter 6. Strategic Cybersecurity.- Chapter 7. Strategic Defensive Security.- Chapter 8. Infinite Cybersecurity.- Chapter 9. Cybersecurity and Game Theory.- Chapter 10. Game Theory Case Study: Ransomware.
Dr. Jacob G. Oakley spent over seven years in the U.S. Marines and was one of the founding members of the operational arm of Marine Corps Forces Cyberspace Command at Ft. Meade, Maryland, leaving that unit as the senior Marine Corps operator and a division technical lead. After his enlistment he wrote and taught an advanced computer operations course, eventually returning back to mission support at Ft. Meade. He later left government contracting to do threat emulation and red teaming at a private company for commercial clients, serving as principal penetration tester and director of penetration testing & cyber operations. He is currently working as a Cyber SME for a government customer. He completed his doctorate in IT at Towson University researching and developing offensive cybersecurity methods and is the author of Professional Red Teaming: Conducting Successful Cybersecurity Engagements as well as Waging Cyber War: Technical Challenges and Operational Constraints.
Über den Autor
Dr. Jacob G. Oakley is a cybersecurity author and subject matter expert with 16 years of experience focusing on strategic enterprise-level cybersecurity architectures as well as offensive cybersecurity operations within government and commercial sectors. His previous technical books, Professional Red Teaming, Waging Cyber War, and Cybersecurity for Space, are also published by Apress.
Michael Butler is a cybersecurity subject matter expert with 12 years of experience focusing on building, developing, and leading teams of ethical hackers. He is a primary instructor and developer of an offensive cloud security course taught both privately and at Blackhat conferences in the United States, Europe, and Asia. He has previously collaborated with Dr. Oakley as the technical reviewer for Professional Red Teaming.
Wayne York is a cybersecurity technical editor and subject matter expert with 18 years of experience focusing on offensive cybersecurity operations and program protection within government and commercial sectors. His previous technical edited book is Waging Cyber War by Dr. Oakley, published by Apress.
Dr. Matthew Puckett is a mathematics professor and former software engineer. His areas of interest include theology, cognitive science, and artificial intelligence. His hobbies include chess, where he is currently one of the top 300 players in the United States (according to FIDE).
Dr. J. Louis Sewell is a mathematician trained in Graph Theory. As Technical Fellow of a Huntsville, AL, technology company, he develops enduring solutions to critical infrastructure challenges in government and civilian sectors. Professionally and personally, he has a special interest in artificial intelligence ethics, infinite game dynamics, and the role of personal experience in the philosophy of science.
Inhaltsverzeichnis
Chapter 1. Introduction to Strategic Cybersecurity
Discuss what strategic cybersecurity is
Discussion on how it is not cybersecurity strategy
Chapter 2. No one cares about cybersecurity
Real motivations
Consequences
How can cybersecurity help them in spite of themselves?
Chapter 3. Cost-Benefit & Cybersecurity
Cost-Benefit to the defender
Cost-Benefit to the attacker
Chapter 4. What is the box that is cybersecurity?
Where do we draw the line?
What are areas that should be abandoned
What are areas that should be explored
Chapter 5. The detect, prevent, accept paradigm
Outline the paradigm
Case studies
Chapter 6. Building your own cybersecurity box
What is out of the cyber domain: sim swapping, go daddy
What is likely to be your attacker
What is likely to be your loss
Chapter 7. Cybersecurity as a material
Capability Analysis
Sourcing
Test and evaluation
Utilization
Deprecation
Failure analysis
Chapter 8. Cybersecurity as infrastructure
A comparison to electricity
How do we get there and what will it mean?
Chapter 9. Strategic Defensive Security
Detect
Identify
Monitor
Hunt
Chapter 10. Strategic Offensive Security
Penetration testing
Red Teaming
Reverse Red Teaming
Chapter 11. Strategic Assurance
Frameworks
Auditing
Case study
Chapter 12. Strategic cybersecurity in commercial sectors
The approach
Case study
Chapter 13. Strategic cybersecurity in accountable sectors
Healthcare approach
Case study
Financial approach
Case study
Chapter 14. Strategic Magic
AI
ML
Block Chain
Chapter 15. Looking Forward
Where is the theory-craft?
We need new ideas and paradigms as much as we need new technology
Why is it difficult for academia to evolve cybersecurity?
Especially offensive cybersecurity
What is wrong with cybersecurity currently in academics
Degree programs
Unrealistic expectations
Potential solutions
Why does industry often lack an academic approach?
Klappentext
There is a distinct lack of theoretical innovation in the cybersecurity industry. This is not to say that innovation is lacking, as new technologies, services, and solutions (as well as buzzwords) are emerging every day. This book will be the first cybersecurity text aimed at encouraging abstract and intellectual exploration of cybersecurity from the philosophical and speculative perspective. Technological innovation is certainly necessary, as it furthers the purveying of goods and services for cybersecurity producers in addition to securing the attack surface of cybersecurity consumers where able. nnnThe issue is that the industry, sector, and even academia are largely technologically focused. There is not enough work done to further the trade¿the craft of cybersecurity. This book frames the cause of this and other issues, and what can be done about them. Potential methods and directions are outlined regarding how the industry can evolve to embrace theoretical cybersecurity innovation as it pertains to the art, as much as to the science. nnnTo do this, a taxonomy of the cybersecurity body of work is laid out to identify how the influences of the industry¿s past and present constrain future innovation. Then, cost-benefit analysis and right-sizing of cybersecurity roles and responsibilities¿as well as defensible experimentation concepts¿are presented as the foundation for moving beyond some of those constraining factors that limit theoretical cybersecurity innovation. Lastly, examples and case studies demonstrate future-oriented topics for cybersecurity theorization such as game theory, infinite-minded methodologies, and strategic cybersecurity implementations.nnnWhat yoüll learnnn The current state of the cybersecurity sector and how it constrains theoretical innovationn How to understand attacker and defender cost benefit The detect, prevent, and accept paradigmn How to build your own cybersecurity boxn Supporting cybersecurity innovation through defensible experimentationn How to implement strategic cybersecurityn Infinite vs finite game play in cybersecurityn n nWho This Book Is FornnThis book is for both practitioners of cybersecurity and those who are required to, or choose to, employ such services, technology, or capabilities.nnnn
Learn how to move cybersecurity forward both philosophically and technologically
Gain perspective of macro-level cybersecurity and ty it into technical micro-level examples
Dive deep on some aspects about cybersecurity to clarify what is meant by the term in its various contexts
